DAP LUA match ipad device unique id to cert

Question

Hi,
I am trying to configure a DAP policy using LUA to perform a check that a cert has not been moved. I cert has been configured to store the ipads device unique id in the subject cn field, which i have verified on the device. I have configured the following LUA statement but i am not getting a match:
EVAL(endpoint.anyconnect.deviceuniqueid, "NE", endpoint.certificate.user[“0”].subject_cn, "caseless")
Is this check posssible with ipads?
Thank you.

Answer 1

So in the end I had the same problem with this script.  Never really fixed it but did workaround with that script by making local match_valueX for X number of certs you think folks will have in the their store.  So most people won't have 64....but really you could cut and paste to any number you like.
assert(function()
local match_pattern = endpoint.device.hostname..".domain.com"
local match_value0 = endpoint.certificate.user["0"].subject_cn
local match_value1 = endpoint.certificate.user["1"].subject_cn
local match_value2 = endpoint.certificate.user["2"].subject_cn
if match_pattern==match_value0 then
return true
elseif match_pattern==match_value1 then
return true
elseif match_pattern==match_value2 then
return true
else
return false
end
end ) ()
Another option is to do a username to mapping from certificate script that simply
returns cert.subject.cn "/" cert.subject.ou (where the UDID was populated)
And the use a DAP to parse to verify anyconnect deviceuniqueid and aaa.cisco.username match (ie the UDID from anyconnect and what is in the cert)
assert function ()
local match_pattern = endpoint.anyconnect.deviceuniqueid
local match_value = aaa.cisco.username
if (type(match_value) == "string") then
if (string.find(match_value, match_pattern) ~= nil) then
return false
end
elseif (type(match_value) == "table") then
local k,v
for k,v in pairs(match_value) do
if (string.find(v, match_pattern) ~= nil) then
return false
end
end
end
return true
end) ()